# Cursor: a backdoored Claude Code extension opened SSH tunnels

> A tampered Claude Code extension served by Cursor's own marketplace installed a persistent SSH backdoor on developer machines.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Supply chain, Incident
- **Published by:** Cursor
- **Disclosed:** 2026-10-29
- **Affects:** Cursor, Claude Code
- **Research by:** Paul McCarty (OpenSourceMalware), Socket Research Team (Socket)
- **Primary source:** https://cursor.com/blog/claude-code-extension-security-notice
- **Page:** https://theinjection.dev/items/cursor-claude-code-extension-backdoor/

Cursor served tampered builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, from its own extension marketplace for part of October 29, 2026. Cursor said at most 5,000 users were affected.

## What happened

Cursor published a security notice on October 29, 2026 about malicious builds of the Anthropic.claude-code extension served from the Cursor extension marketplace. Cursor says the builds were available from about 2:27am to 1:35pm Pacific time that day and were not developed by Anthropic. Socket reports that the first analysis came from Paul McCarty at OpenSourceMalware, and that Cursor later confirmed its own marketplace was the distribution channel.

## How it works

The malicious version shipped a modified extension.js inside the darwin-arm64 and win32-x64 folders of the package. On execution it collected host and account details, including hostname, username, operating system, home directory, configured Git email and public IP. The code then tried to append an attacker-controlled SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel to the attacker's host. Cursor says the tunnel step usually failed because it needs administrator rights, but the key and the persistence were still installed.

## Who is affected

Developers who installed or updated the Claude Code extension through the Cursor extension marketplace during the October 29 window are exposed, on macOS and Windows. Cursor's notice now names two affected builds, 2.1.312 and 2.1.313, after listing only 2.1.313 when it was first published. Cursor states it has no evidence that other versions of the extension or Anthropic's official distribution are affected.

## What to do

Check affected machines for the indicators in Cursor's notice, starting with an SSH key commented svc-telemetry in authorized_keys, then run Cursor's remediation script for macOS or Windows. Isolate any host that shows the payload ran, and rotate credentials and sessions reachable from it from a trusted machine. Cursor warns that uninstalling the extension may not be enough and that the host may need to be rebuilt.

## Quick facts

- **Affected:** Anthropic.claude-code 2.1.312 and 2.1.313, served from the Cursor extension marketplace
- **Window:** About 2:27am to 1:35pm Pacific time, October 29, 2026
- **Scope:** At most 5,000 users, per Cursor
- **Attack type:** Tampered extension build carrying an SSH backdoor and persistence
- **Persistence:** macOS LaunchAgent com.apple.sysmond; Windows scheduled task SysMon; Linux @reboot cron, per Phorion
- **Network indicators:** Reverse SSH tunnel to 134.209.82.225 and a one-time HTTP beacon to port 8099, per Phorion
- **Status:** Versions removed, marketplace keys rotated and rebuilt, attacker server offline; indicators updated October 30, per Cursor
- **Found by:** Paul McCarty, OpenSourceMalware, per Socket

## Questions

### Am I affected if I installed the Claude Code extension from Cursor on October 29?

Cursor says users who installed or updated the Claude Code extension through its marketplace between about 2:27am and 1:35pm Pacific time on October 29, 2026 may have received the tampered 2.1.313 build. Cursor puts the upper bound at 5,000 users and is contacting them directly. Checking for an SSH key commented svc-telemetry in authorized_keys is the fastest confirmation.

### Is the official Claude Code extension from Anthropic safe?

Cursor states the malicious 2.1.313 build was not developed by Anthropic and that it has no evidence that other versions of the extension or Anthropic's official distribution are affected. Cursor also audited marketplace access and found no other extension had been tampered with. Socket notes that npm and GitHub releases skip 2.1.313 and that the 2.1.314 changelog does not explain the gap.

### Is uninstalling the extension enough to clean an affected machine?

Cursor says uninstalling the Claude Code extension may not be enough, because the payload installs an SSH key and persistence that survive removal. Cursor publishes remediation scripts, remediate-macos.sh to run as the affected user and remediate-windows.ps1 to run as Administrator, and advises isolating hosts that show payload execution. Cursor adds that some machines may need to be rebuilt.

### How does the Cursor marketplace incident compare with the LiteLLM package compromise?

Both incidents put attacker code into a trusted distribution channel used by AI developers, but the reach differs. LiteLLM 1.107.0 shipped credential-stealing wheels to PyPI, which PyPI quarantined. The Cursor case involved one extension version served from a single vendor's own marketplace for part of October 29, with Cursor rebuilding the marketplace afterwards and capping exposure at 5,000 users.

## Sources

1. [Cursor Security Notice](https://cursor.com/blog/claude-code-extension-security-notice)
2. [Socket Analysis](https://socket.dev/blog/claude-code-extension-compromise)
3. [Phorion Teardown](https://phorion.io/blog/offical-claude-code-vsx-compromise/)